1. Controller and contact

Controller: TengrX. Address: İzmir, Türkiye. Email: tarik@amen-app.com. “Versea” is an app brand and is not the controller’s legal identity.

This notice reflects the data flows in the app’s current source code. Older app versions may have created different records; the request and deletion routes below apply to them as well.

2. Data that stays on your device

Your prayer and journal notes, the name you enter for personalisation, your preferences, local reading progress and AI chat archive are kept in your device’s storage and are not sent to us. The app excludes the chat archive from backups; other local data may be included in iCloud/device backups that you control in iOS.

When you accept the Terms of Use, the document version, date, language and URL are stored on your device. That acceptance alone creates no network request, account or consent record.

You start actions such as sharing, exporting or saving images; the rules of wherever you share apply.

3. What we process and why

The processing below happens only when you use the feature concerned and give the stated permission.

  • Cloud progress (separate permission): saved verses, reading and completion records, bookmarks, quest and quiz progress and results, linked to a random account ID (Supabase user UUID). Purpose: keeping your progress and providing cloud features. Your prayer/journal texts are not part of this sync.
  • AI chat and verse explanations (separate permission + age 18 declaration): your messages, the recent conversation history needed for a reply, your chosen topic and language, and public verse context for explanations. Purpose: generating replies and preventing abuse. Your personal reading history is never silently added.
  • Cloud voice (separate permission): the text to be read aloud, chosen voice, language and speed. The default is your device’s on-device voice. No microphone recordings are sent.
  • Dictation: on supported devices, speech recognition runs on the device; where it isn’t supported the app does not silently fall back to the cloud. If you send dictated text to the AI, the AI flow applies.
  • Consent records: account ID, purpose, version, date, language, adult declaration and withdrawal. Purpose: proving and honouring your consent.
  • Usage measurement: permitted behavioural events plus app version, language, subscription status and experiment group. Without permission, only limited session measurement runs, using a random ID held in memory for that launch and changed on every launch; with permission, a persistent random ID stored on the device is used. No prayer/chat text, audio, reading content, verse IDs or free text is sent. With analytics permission, your answer to “where did you hear about us” is also stored.
  • Purchases: Apple and RevenueCat verify your entitlements; a random RevenueCat ID, product, transaction and subscription status, experiment group and app version are processed. Your card details never reach us.
  • Support: when you tap Send, your message, request type, language, app version, platform and account ID. If you email us, your address and correspondence.
  • Content and technical connections: when Bible text and translations are requested, content providers can see your IP address and technical request data.
  • Website: when you visit versea.tengrx.com the hosting provider processes your IP address, browser information and request time in technical logs (see section 12).

The absence of a name or phone number does not make data anonymous. Random IDs, rounded location and disabled IP enrichment reduce risk but do not make the processing legally anonymous, so we protect these records as personal data too.

Each activity relies on one appropriate legal basis:

  • Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): core app functions, verifying purchases and entitlements, support you request.
  • Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)): answering your requests, keeping consent and deletion records, requests from competent authorities.
  • Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): security, abuse prevention, technical monitoring that the service works, and limited session measurement without permission. To keep this from overriding your rights, no persistent ID or content is used; you may object.
  • Consent (KVKK Art. 5(1); GDPR Art. 6(1)(a) and ePrivacy rules): optional processing such as persistent analytics and cloud voice.
  • Explicit consent for special category data (KVKK Art. 6(3)(a); GDPR Art. 9(2)(a)): cloud progress and AI chat content that may reveal religious belief or practice.

Accepting the Terms of Use or buying Premium does not grant any of the consents above. If you decline a consent-based feature, only that feature stops working; you can keep using the rest of the app.

5. Religious belief and other sensitive data

Versea is a Bible app. Reading habits, saved verses or chat topics can reveal information about your religious belief; such information may be special category data under KVKK Art. 6 and GDPR Art. 9. We process it only with the explicit consent you give for the feature concerned, for the stated purpose and only as far as necessary.

Messages you write to the AI may contain health, family or other sensitive information. Please don’t share sensitive information that isn’t needed, or other people’s personal data.

We do not use this data for ad targeting and we do not sell it. No feature content, verses you read or chat information is used for advertising.

Cloud progress, AI chat and explanations, cloud voices and persistent analytics start switched off. You can switch each on or off at any time in the app’s privacy preferences. iOS permissions for notifications, location, microphone, speech recognition, photos, Screen Time and tracking are requested separately when a feature first needs them and can be changed in iOS Settings.

Withdrawing consent stops future processing; it does not affect processing lawfully carried out before, and it does not by itself delete past records. Use section 10 to delete. Turning analytics off deletes the persistent ID and returns to limited session measurement; it does not stop every measurement request.

7. Age limits and children

Versea’s App Store age rating is 13+ (it may differ in some regions and on older operating systems). The app is not directed at children under 13 and we do not knowingly collect personal data from them.

AI chat and verse explanations are available only to users who declare they are 18 or older. This is a self-declaration, not independent age verification; a false declaration is the user’s responsibility.

If the age of digital consent where you live is higher (between 13 and 16 in EU member states; parental consent for minors in Türkiye), switch on consent-based features only with your parent’s or guardian’s approval. If we learn that a child’s data was processed without the required approval, we delete it. Parents can simply write to tarik@amen-app.com.

8. Recipients

We do not sell or rent personal data. We share it only with the following groups of recipients, which run part of the service on our behalf or under their own responsibility, limited to the purpose concerned:

  • Supabase: authentication, database and server functions (cloud progress, consent records, support, relaying AI and voice requests).
  • OpenAI: AI chat, verse explanations and cloud voice. OpenAI API content is not used for model training by default; it may be retained for a limited time for abuse monitoring.
  • Mixpanel: usage measurement (EU endpoint; location enrichment disabled).
  • RevenueCat and Apple: purchase and subscription verification; Apple also provides the App Store, Screen Time, notification and iCloud services under its own responsibility.
  • getBible (getbible.net) and content delivery networks: Bible text and translations.
  • Cloudflare: hosting of versea.tengrx.com and related web pages. Email providers: correspondence you send by email.
  • Competent public authorities and courts: only where legally required.

With service providers we rely on contracts requiring them to process data only on our instructions and with appropriate security. Some recipients, such as Apple and content providers, act as independent controllers for their own services under their own privacy policies.

In a merger, acquisition or asset sale, data may pass to the new operator with the safeguards in this policy preserved; we will inform you in advance.

9. International transfers

Some of the providers above use infrastructure outside Türkiye and the European Economic Area (for example in the United States and India). Your data may therefore be transferred abroad from Türkiye and the EU. We do not guarantee processing only in Türkiye or only in the EU.

Transfers from Türkiye rely on KVKK Art. 9: an adequacy decision of the Board where one exists; otherwise the standard contracts published by the Board (notified to the Board within five business days of signature) or other appropriate safeguards; and, only where none of these is possible, the occasional cases listed in the law. Transfers from the EEA rely on adequacy decisions under GDPR Art. 45 (for example the EU–US Data Privacy Framework) or standard contractual clauses under Art. 46.

You can request a summary or copy of the transfer mechanism used for any recipient at tarik@amen-app.com.

10. Retention and deletion

  • On-device data: stays on your device until you delete it or remove the app; iOS backups are under your control.
  • Account-linked cloud records: for as long as your account exists or until you delete them; active records are deleted when the account is deleted.
  • Consent and deletion records: as long as needed to prove consent and requests, within statutory limitation periods.
  • Support correspondence: until your request is resolved and any dispute periods have passed.
  • Analytics, purchase and provider records: according to each provider’s retention settings and legal retention duties; deleted, destroyed or anonymised once the purpose ends.

You can delete your account and your server-side data with the “Delete Account & Data” action at the bottom of the Profile screen in the app. If the server does not confirm deletion, an error is shown and your local data and ID are kept; you can try again or write to tarik@amen-app.com. Deleted data leaves providers’ logs and backups when their backup cycles complete. You must cancel your subscription separately in Apple Account → Subscriptions.

We delete personal data on our own initiative or at your request once the purpose of processing ends, in line with KVKK Art. 7 and the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

11. Security

Data is encrypted in transit with TLS. On the server we use authenticated requests, row-level security (RLS), per-purpose consent checks and the principle of least privilege. AI requests go through content safety checks.

No system is completely secure. If a personal data breach is likely to affect your rights and freedoms, we notify the competent supervisory authority within the time limits set by KVKK and GDPR (72 hours from becoming aware under GDPR) and inform you where required.

12. Website and cookies

versea.tengrx.com uses no analytics, advertising or social media cookies and no tracking pixels. Fonts are served from the site’s own server.

When you use the language switcher, a first-party cookie named “versea-locale” remembers your choice in your browser for one year. It is strictly necessary for the function you asked for and needs no consent; you can delete it in your browser.

On your first visit, the country that the hosting infrastructure derives from your IP address is used momentarily to send you to the right language; we do not store it. The hosting provider (Cloudflare) keeps technical access logs for security and operation.

The site links to the App Store and to source websites. Their privacy policies apply once you go there.

13. Automated decision-making

We make no decisions based solely on automated processing that produce legal or similarly significant effects for you (GDPR Art. 22). AI features only generate the text you ask for; a safety check may decline a request, which does not affect your account or rights. Experiment groups are assigned at random to test different versions of app screens.

14. Your rights and requests

Under KVKK Art. 11 you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request rectification of incomplete or inaccurate data and, where the conditions are met, erasure or destruction; to request that these actions be notified to the third parties concerned; to object to an outcome against you resulting solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests.

Send your request to tarik@amen-app.com or in writing to İzmir, Türkiye (Communiqué on the Procedures and Principles of Applications to the Controller). We may ask for the minimum information needed to find the right record and verify your identity; do not send passwords, access keys or prayer/chat content. Requests are answered free of charge within 30 days at the latest; if an action incurs a separate cost, the fee set by the Board may be charged.

If your request is refused, you find the answer insufficient or it is not answered in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your request. If you are in the EU, you may also complain to the data protection supervisory authority where you live or work.

15. Changes

We update this notice when the service or the law changes; the current version and date appear at the top of this page. We announce significant changes in the app. If a new purpose requires consent, we ask for it separately before starting that processing.

This notice is published in English, Spanish, Russian and German. If translations differ, the English text prevails; this does not affect your rights under the mandatory law of the country where you live.